Fix cookie keys and add comment re: protect_from_forgery behavior